Is CVE-2026-5231 actively exploited?

Yes. CVE-2026-5231 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2026-5231 be exploited remotely?

Yes. CVE-2026-5231 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-5231?

CVE-2026-5231 has a CVSS score of 7.2 (HIGH).

HOME VULNERABILITIESCVE-2026-5231

HIGHCISA KEVIN THE WILD

CVE-2026-5231

CWE-79Published: April 17, 2026· Updated: Apr 22, 2026

7.2

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:6.6th

Official Description

The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_source' parameter in all versions up to, and including, 14.16.4. This is due to insufficient input sanitization and output escaping. The plugin's referral parser copies the raw utm_source value into the source_name field when a wildcard channel domain matches, and the chart renderer later inserts this value into legend markup via innerHTML without escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in admin pages that will execute whenever an administrator accesses the Referrals Overview or Social Media analytics pages.

NVD Source

Technical Analysis

CVE-2026-5231 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

CISA has added CVE-2026-5231 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.